Power Supply System and Method for Controlling Power Supply System

The present invention relates to a power supply system and a method for controlling the power supply system.

There is known a conventional method for controlling an autonomous vehicle power supply that has a circuit connection/disconnection mechanism between a first load circuit that uses a main battery as a power source and a second load circuit that uses an additional battery as a power source (Patent Document 1). The first load circuit is connected to a load necessary to continue a normal driving mode by a driver, and the second load circuit is connected to an autonomous function load necessary to continue an autonomous driving mode and to maintain a voltage. In this method for controlling an autonomous vehicle power supply, when it is determined that electric power is to be drawn from the additional battery to the first load circuit side based on a load state detected on the second load circuit side while the circuit connection/disconnection mechanism is in a connected state, the circuit connection/disconnection mechanism enters a disconnected state.

Patent Document 1: Japanese Unexamined Patent Application Publication No. 2017-177857

The method for controlling an autonomous vehicle power supply described in Patent Document 1 has a problem that the additional battery is discharged by a dark current of the load because the additional battery cannot be disconnected from the load.

A problem to be solved by the present invention is to provide a power supply system and a method for controlling the power supply system to prevent an additional battery from being discharged by a dark current of a load.

To solve the above problem, the present invention includes: a first load circuit configured to operate using electric power from a main battery, the first load circuit being connected to a first load; a second load circuit configured to operate using electric power from the main battery or an additional battery, the second load circuit being connected to a second load; a first relay provided on a power supply line for electrically connecting the first load and the second load, the first relay being configured to electrically connect or disconnect the first load circuit to or from the second load circuit; a second relay configured to electrically connect or disconnect the second load to or from the additional battery; and a controller configured to determine a state of a start switch for starting a vehicle.

According to the present invention, the second relay can disconnect the load from the additional battery, making it possible to prevent the additional battery from being discharged by a dark current of the load.

An embodiment of a power supply system and a method for controlling the power supply system according to the present invention will be described below with reference to the drawings.

1 FIG. 100 100 is a schematic diagram of a configuration of a power supply systemaccording to the present embodiment. In the present embodiment, a vehicle in which the power supply systemis installed will be described using as an example a vehicle that includes an engine serving as a drive source and has an autonomous travel control function. A vehicle having an autonomous travel control function has a normal driving mode and an autonomous driving mode as driving modes. When the vehicle is set to the normal driving mode, the vehicle travels according to driving operations (steering operation, accelerator operation, brake operation, etc.) by a driver. On the other hand, when the vehicle is set to the autonomous driving mode, the vehicle travels according to a driving operation by a driver assistance device (not illustrated) in addition to the driver.

2 In the autonomous driving mode, the content of a driving assist provided by the autonomous travel control function may differ depending on a driving assist level. The driving assist level is a level indicating the degree of intervention when the driver assistance device assists driving of the vehicle using the autonomous travel control function. The higher the driving assist level, the lower the degree of driver's contribution to the driving of the vehicle. Specifically, the driving assist level can be set using definitions based on SAE J3016 of the Society of Automotive Engineers (SAE) and the like. In the present embodiment, the driving assist level provided by the driver assistance device will be described as driving assist level. Further, in the present embodiment, a vehicle having a mode (also referred to as a hands-off mode) in which the vehicle autonomously travels without the driver touching the steering wheel will be described as an example. In the hands-off mode in which the driver assistance device performs some driving tasks on behalf of the driver, the driver needs to prepare to take back driving control and manually drive in response to a request from the driver assistance device. Further, in the hands-off mode, a redundant function is required to continue autonomous travel until the driver performs a driving operation in response to a request from the driver assistance device. As an example of the redundant function, a vehicle having an autonomous driving mode, for example, is provided with an additional battery that functions as a backup power supply source for a load required for the autonomous travel control function.

However, the additional battery being mounted has a problem that the additional battery is discharged by a dark current of the load connected to the additional battery while an ignition switch of the vehicle is in an off state. As the additional battery is discharged by the dark current of the load, the remaining battery level of the additional battery decreases. This may make it impossible to supply the load with the electric power necessary to continue autonomous travel in the autonomous driving mode, resulting in the additional battery not functioning as a backup power supply source. In the power supply system and the method for controlling the power supply system according to the present invention, with a configuration and method that will be described below, it is possible to prevent the additional battery from being discharged by the dark current of the load and to supply the electric power necessary to continue autonomous travel to the load in the autonomous driving mode. Note that, hereinafter, the above-described driver assistance device will be described as a component included in an advanced driver assistance system (ADAS).

1 FIG. 100 1 2 3 4 5 6 As illustrated in, the power supply systemincludes a first load circuit, a second load circuit, a power supply line, a main relay, an additional relay, and a controller.

1 11 14 1 11 12 13 14 3 12 13 1 FIG. The first load circuitis a load circuit that operates using electric power from a lead battery(main battery) or an alternator, and that is connected to a first load necessary to continue the above-described normal driving mode. In the present embodiment, the first load circuitincludes the lead battery, a load actuator, a starter motor, and the alternator, which are connected to the power supply line, as illustrated in. Examples of the first load necessary to continue the normal driving mode include the load actuatorand the starter motor.

11 11 14 14 11 The lead batteryis a secondary battery used as a main battery that is mounted in conventional engine vehicles. The lead batteryis charged by the alternatorserving as a generator so that the remaining battery level does not decrease. The alternatorgenerates electricity using a rotational drive mechanism (not illustrated) driven by an engine, and charges the lead batteryso that the remaining battery level is maintained at a predetermined remaining battery level or higher.

12 11 14 12 68 11 14 12 68 11 12 The load actuatoris an auxiliary machine that operates using electric power from the lead batteryor electric power generated by the alternator. Examples of the load actuatorinclude an electric motor that drives a compressor of an air conditioner and a headlight. When an ignition switchof the vehicle is on (hereinafter also referred to as a travel-ready state of the vehicle), the electric power stored in the lead batteryor the electric power generated by the alternatoris supplied to the load actuator. On the other hand, when the ignition switchof the vehicle is off (hereinafter also referred to as a parked state of the vehicle), the electric power stored in the lead batteryis supplied to the load actuator. Note that the travel-ready state of the vehicle indicates a state that is unrelated to the vehicle speed of the vehicle, and includes a state in which the vehicle is traveling and a state in which the vehicle is stopped.

13 The starter motoris a motor for starting the engine, which starts the engine to start the vehicle and restarts the engine from a no idling state.

2 11 21 2 22 23 24 61 3 22 23 24 1 FIG. The second load circuitis a load circuit that operates using electric power from the lead batteryor a lithium ion battery(additional battery), and that is connected to a second load necessary to continue the above-described autonomous driving mode. In the present embodiment, the second load circuitincludes an EPS actuator, an ABS actuator, an ADAS actuator, and a current sensor, which are connected to the power supply line, as illustrated in. Examples of the second load necessary to continue the autonomous driving mode include the EPS actuator, the ABS actuator, and the ADAS actuator. The range of input voltage for each actuator has been defined according to the specifications of the actuator, and in order for the actuator to continue to operate according to the specifications, the input voltage for the actuator needs to be kept within the range of the input voltage defined by the specifications.

21 11 21 2 21 4 5 1 21 21 14 6 2 4 5 4 21 21 4 4 21 14 21 1 FIG. The lithium ion batteryis a secondary battery added as a new power source to a power source provided by the lead batteryto continue the autonomous travel control function of the vehicle. In other words, the lithium ion batteryis a backup power supply source that supplies electric power to each load included in the second load circuitin order to continue autonomous travel in the autonomous driving mode. Charging and discharging of the lithium ion batteryis controlled by a battery management system (BMS). In the example of, when the main relayand the additional relayare in an on state, the first load circuitis electrically connected to the lithium ion battery, so that the battery management system charges the lithium ion batteryusing the electric power generated by the alternator(generator). As will be described later, when the controllerdetermines that the driving mode of the vehicle is the autonomous driving mode and the circuit voltage of the second load circuitfalls outside a predetermined voltage range, the main relayswitches from on to off. However, since the additional relaymaintains the on state, an electrically-connected state is maintained between the additional battery and the second load circuit before and after the main relayswitches from on to off. The battery management system outputs electric power charged in the lithium ion batteryto the second load to discharge the lithium ion battery. Once the main relayswitches from on to off in the autonomous driving mode, the main relaymaintains an off state until the driving mode changes from the autonomous driving mode to the normal driving mode, so that the lithium ion batterycannot be charged using the electric power generated by the alternator. For this reason, the capacity of the lithium ion batteryis set to an appropriate capacity, for example, such that the time during which the vehicle continues to travel in the autonomous driving mode is at least a required time or longer.

21 11 22 Further, the lithium ion batteryhas a characteristic of lower internal resistance than the lead battery. Therefore, for example, even when the EPS actuatoroperates and consumes a large amount of current, the voltage can be maintained high.

22 22 The EPS actuatoris an EPS motor that generates electric assist force, and is also a load that needs to operate in the autonomous driving mode. The EPS actuatoris used in an electric power steering system (not illustrated) that electrically assists the force necessary for a steering operation to reduce steering force. “EPS” as used herein is an abbreviation for “Electric Power Steering”.

23 23 The ABS actuatoris a pump motor or an electromagnetic valve that drives a hydraulic pump, and is also a load that needs to operate in the autonomous driving mode. The ABS actuatorincludes an electric hydraulic pump, and is used in a brake hydraulic pressure control system (not illustrated) that independently controls the hydraulic pressure of each wheel cylinder based on hydraulic oil from a master cylinder and a hydraulic pump. “ABS” as used herein is an abbreviation for “Antilock Brake System”.

24 24 70 The ADAS actuatoris an actuator that performs various driving operation assists to assist the driver's driving operations, and is also a load that needs to operate in the autonomous driving mode. The ADAS actuatoris used in an advanced driver assistance system.

3 1 2 12 1 22 23 24 2 3 The power supply lineis a wire harness that electrically connects the first load circuitand the second load circuitto supply electric power. Electric power is supplied to the load actuator, which is included in the first load circuit, and the EPS actuator, the ABS actuator, and the ADAS actuator, which are included in the second load circuit, via the power supply line.

4 3 1 2 1 2 4 3 1 4 3 2 4 4 4 The main relayis a circuit connection/disconnection mechanism that is provided on the power supply linebetween the first load circuitand the second load circuitto electrically connect or disconnect the first load circuitto or from the second load circuit. One terminal of the main relayis connected to the power supply lineon the first load circuitside, and the other terminal of the main relayis connected to the power supply lineon the second load circuitside. In the present embodiment, a normally open type of relay is used as the main relay. Examples of the main relayinclude a mechanical relay (also referred to as a mechanical relay) and a semiconductor relay. A mechanical relay has contacts and is switched on and off by mechanically opening and closing the contacts using electromagnetic action. A semiconductor relay does not have contacts, is composed of a semiconductor, such as a metal-oxide-semiconductor field-effect transistor (MOSFET), and electronic components, and is switched on and off by an electrical signal. In the present embodiment, the main relaywill be described using as an example a semiconductor relay having a self-disconnection/connection function that autonomously switches on and off for overvoltage protection and overcurrent protection.

6 4 4 6 4 4 4 4 4 4 4 1 2 4 4 4 1 2 4 4 4 4 4 An opening/closing control signal is input from the controllerto the main relay, and the main relayis turned on or off according to the input opening/closing control signal. In addition to the opening/closing control signal, a connection maintaining command or a cancellation command is input from the controllerto the main relay. Once the connection maintaining command is received, the main relaycontinues to maintain the on state until the cancellation command is received, regardless of whether the opening/closing control signal is received. When the cancellation command is received after the connection maintaining command is received, the main relaycancels the on state being maintained and is turned on or off again according to the opening/closing control signal. In a case where the main relayis a semiconductor relay as in the present embodiment, the opening/closing control signal is, for example, a switching signal for switching a semiconductor, such as a switching element, from on to off or from off to on. Further, the connection maintaining command is a signal for disabling the self-disconnection/connection function to maintain the on state, for example, in order to prevent the main relayfrom being switched from on to off by the self-disconnection/connection function. Further, the cancellation command is, for example, a signal for enabling the self-disconnection/connection function. Examples of the self-disconnection/connection function include a protection function that switches the main relayfrom on to off when the voltage applied between the terminals of the main relay(between the terminal connected to the first load circuitand the terminal connected to the second load circuit) is an abnormal voltage. The abnormal voltage is, for example, a predetermined overvoltage defined by the specifications of the main relay. Further, examples of the self-disconnection/connection function include a protection function that switches the main relayfrom on to off when the current flowing through the main relay(the current flowing from the first load circuitside to the second load circuitside) is an abnormal current. The abnormal current is, for example, a predetermined overcurrent defined by the specifications of the main relay. Note that, in the following description, “on (on state) of the main relay” refers to a state where the terminals of the main relayare electrically connected to each other, and “off (off state) of the main relay” refers to a state where the terminals of the main relayare insulated (disconnected).

4 6 4 4 4 4 4 Further, in the present embodiment, the main relaywill be described using as an example a semiconductor relay having a self-diagnosis function that autonomously performs a failure diagnosis in addition to the self-disconnection/connection function. When a failure diagnosis start signal is input from the controllerto the main relay, the main relayperforms a failure diagnosis using the self-diagnosis function. In the present embodiment, the failure diagnosis for the main relaywill be described using as an example a diagnosis of whether or not a stuck-on condition in which the main relayis stuck in the on state has occurred (also referred to as a stuck-on failure diagnosis or a short-circuit failure diagnosis). The stuck-on failure diagnosis for the main relaywill be described later.

5 3 2 22 23 24 21 5 21 5 3 2 61 5 4 5 5 The additional relayis a battery connection/disconnection mechanism that is electrically connected to the power supply lineon the second load circuitside to electrically connect or disconnect the EPS actuator, the ABS actuator, and the ADAS actuatorto or from the lithium ion battery. One terminal of the additional relayis connected to the lithium ion battery, and the other terminal of the additional relayis connected to the power supply lineon the second load circuitside via the current sensor. In the present embodiment, a normally closed type of relay is used as the additional relay. As with the main relay, examples of the additional relayinclude a mechanical relay and a semiconductor relay. In the present embodiment, the additional relaywill be described using a mechanical relay as an example.

6 5 5 6 5 5 5 5 5 5 5 5 5 5 An opening/closing control signal is input from the controllerto the additional relay, and the additional relayis turned on or off according to the input opening/closing control signal. In addition to the opening/closing control signal, a connection maintaining command or a cancellation command is input from the controllerto the additional relay. Once the connection maintaining command is received, the additional relaycontinues to maintain the on state until the cancellation command is received, regardless of whether the opening/closing control signal is received. When the cancellation command is received after the connection maintaining command is received, the additional relaycancels the on state being maintained and is turned on or off again according to the opening/closing control signal. In a case where the additional relayis a mechanical relay as in the present embodiment, the opening/closing control signal is, for example, a voltage application signal for generating a magnetic field to switch the additional relayfrom off to on, or a voltage stop signal for canceling the magnetic field to switch the additional relayfrom on to off. Further, the connection maintaining command is, for example, a forced voltage application signal for continuing to generate a magnetic field to maintain the on state. Note that, in the following description, “on (on state) of the additional relay” refers to a state where the terminals of the additional relayare electrically connected to each other, and “off (off state) of the additional relay” refers to a state where the terminals of the additional relayare insulated (disconnected).

5 21 2 21 5 21 5 21 Further, in the present embodiment, the electrical connection or disconnection of the additional relayaccording to the opening/closing control signal will be described as an example. However, the electrical connection or disconnection between the lithium ion batteryand each load included in the second load circuitmay be performed in other ways. For example, it is conceivable that the power supply system has a configuration in which a DC/DC converter is provided between the lithium ion batteryand the additional relayand the voltage of the lithium ion batteryis boosted by the DC/DC converter to be output. With this configuration, since the DC/DC converter alone can function as a relay, the additional relaymay be electrically connected to or disconnected from the lithium ion batteryunder the control of the DC/DC converter.

6 6 6 6 Next, the controllerwill be described. The controlleris an electronic control unit (ECU) that is composed of a computer with hardware and software and includes a memory that stores a program, a CPU that executes the program stored in this memory, and the like. Note that operable circuits to be used include, instead of or together with the CPU, an MPU, a DSP, an ASIC, and an FPGA. The controllerimplements various functions by the CPU executing programs stored in a ROM. The functions to be implemented by the controllerwill be described later.

1 FIG. 61 62 63 64 65 66 67 68 69 70 6 6 4 5 6 71 72 6 4 As illustrated in, various kinds of information are input from the current sensor, an autonomous driving mode switch, a first voltage sensor, a second voltage sensor, a battery voltage sensor, a brake switch, a torque sensor, the ignition switch, a vehicle speed sensor, and the advanced driver assistance systemto the controller. Further, the controllerexecutes processing based on input information, and outputs an opening/closing control signal, a connection maintaining command, or a cancellation command to the main relayand/or the additional relaybased on the execution result. Furthermore, the controllerexecutes processing based on input information, and outputs a control command to a display deviceand a buzzerbased on the execution result. Further, the controllerexecutes processing based on input information, and performs a failure diagnosis for the main relaybased on the execution result.

61 4 5 21 61 6 4 61 4 The current sensoris provided between the main relayand the additional relayto detect the direction of current with respect to the lithium ion battery. The detection result by the current sensoris output to the controller. Further, as in the present embodiment, in a case where the main relayis a semiconductor relay having a self-diagnosis function, the detection result by the current sensoris also output to the main relay.

62 62 62 62 62 62 6 70 The autonomous driving mode switchis a switch that can be operated by the driver and is also a switch for starting the autonomous driving mode. In a case where the driving mode of the vehicle is the normal driving mode, the autonomous driving mode is started when the driver turns on the autonomous driving mode switch. Further, in a case where the driving mode of the vehicle is the autonomous driving mode, the normal driving mode is started when the driver turns off the autonomous driving mode switch. Although the form, the installation position, and the like of the autonomous driving mode switchare not particularly limited, an example of the autonomous driving mode switchis a button that is provided on a steering wheel and can be operated by the driver. Information on an operation of the autonomous driving mode switchby the driver is output to the controllerand the advanced driver assistance system.

63 1 1 3 1 63 1 63 6 4 63 4 The first voltage sensordetects a circuit voltage of the first load circuit. The circuit voltage of the first load circuitis a voltage of the power supply lineon the first load circuitside. The first voltage sensoris connected in parallel to each component included in the first load circuit, for example. The detection result by the first voltage sensoris output to the controller. Further, as in the present embodiment, in a case where a semiconductor relay having a self-disconnection/connection function is used as the main relay, the detection result by the first voltage sensoris also output to the main relay.

64 2 2 3 2 64 2 64 6 4 64 4 The second voltage sensordetects a circuit voltage of the second load circuit. The circuit voltage of the second load circuitis a voltage of the power supply lineon the second load circuitside. The second voltage sensoris connected in parallel to each load included in the second load circuit, for example. The detection result by the second voltage sensoris output to the controller. Further, as in the present embodiment, in a case where a semiconductor relay having a self-disconnection/connection function is used as the main relay, the detection result by the second voltage sensoris also output to the main relay.

65 21 65 6 66 66 6 67 67 6 The battery voltage sensordetects a battery voltage of the lithium ion battery. The detection result by the battery voltage sensoris output to the controller. The brake switchdetects a brake operation by the driver. Information on the brake operation by the driver detected by the brake switchis output to the controller. The torque sensordetects a steering torque applied to a steering shaft according to a steering operation by the driver. Information on the steering operation by the driver detected by the torque sensoris output to the controller.

68 68 68 68 68 13 68 6 69 69 6 The ignition switchis a start switch (also referred to as a main power switch) for starting the vehicle. In a case of a vehicle with an engine serving as a drive source as in the present embodiment, when the ignition switchis turned on, the engine is started and the vehicle enters the travel-ready state. On the other hand, when the ignition switchis turned off, the engine is stopped and the vehicle enters the parked state. Examples of the type of the ignition switchinclude an ignition key type in which an occupant turns a vehicle key inserted into a keyhole to start a vehicle, and a push button start type in which an occupant presses a button form to start a vehicle. Further, the ignition switchmay be provided with an indicator for starting the drive source of the vehicle (ON indicator) or an indicator for stopping the drive source of the vehicle (OFF indicator), as well as an indicator for energizing an electrical system for a car navigation system, an audio system, and the like which are not related to the travel of the vehicle (ACC indicator), an indicator for starting an air conditioning system by driving the starter motor(START indicator), and the like. Information on an operation of the ignition switchby the driver is output to the controller. The vehicle speed sensordetects a vehicle speed of the vehicle. The detection result by the vehicle speed sensoris output to the controller.

70 70 6 71 72 The advanced driver assistance systemis a system that performs autonomous brake control, autonomous cruise control, lane keep control, and the like to assist driver's driving. The processing results by the advanced driver assistance systemare output to the controller. The display devicedisplays a warning indicator to notify the driver that some abnormality has occurred in the autonomous driving mode and to urge the driver to perform a driving operation. The buzzeroutputs a warning sound to notify the driver that some abnormality has occurred in the autonomous driving mode and to urge the driver to perform a driving operation.

6 100 6 68 2 2 3 FIGS.A,B, and 2 2 FIGS.A andB 1 FIG. Next, the functions implemented by the controllerwill be described with reference to.are flowcharts illustrating an example of a procedure of a method for controlling the power supply systemexecuted by the controllerillustrated in. Note that this procedure of the controlling method is started from a state where the ignition switchis turned off (parked state of the vehicle).

1 6 4 5 5 2 21 5 2 21 In step S, the controlleroutputs a closing control signal to turn on a relay (hereinafter simply referred to as a closing control signal) to the main relay, and outputs an opening control signal to turn off a relay (hereinafter simply referred to as an opening control signal) to the additional relay. When the additional relayis electrically connected to each load included in the second load circuitin the parked state of the vehicle, the lithium ion batteryis discharged by the dark current of the load. By the process of this step, the additional relayis electrically disconnected from each load included in the second load circuit, so that it is possible to prevent the lithium ion batteryfrom being discharged by the dark current of the load.

6 4 5 6 4 5 4 5 6 4 5 4 5 5 4 4 5 2 2 2 FIGS.A andB The processing to be performed by the controllerbefore the opening control signal is output to the main relayor the additional relayin the flowcharts illustrated inwill now be described. In the present embodiment, the controllerperforms opening/closing control of the main relayand the additional relayto turn on at least one of the main relayand the additional relay. Specifically, the controlleracquires information on the state of the main relayand the state of the additional relay, does not output the opening control signal to the main relaywhen the additional relayis in the off state, and does not output the opening control signal to the additional relaywhen the main relayis in the off state. This processing is to prevent both the main relayand the additional relayfrom being turned off and prevent the power supply to each load included in the second load circuitfrom being interrupted.

4 5 61 6 4 5 61 Examples of the information on the states of the main relayand the additional relayinclude a detection result of the current sensor, and the controllerdetermines the states of the main relayand the additional relayfrom the detection result of the current sensor.

61 21 6 4 5 21 1 6 4 5 21 2 6 4 5 6 5 61 4 5 6 4 5 4 5 6 4 5 6 For example, when a current direction detected by the current sensor(hereinafter referred to as a detected current direction) is a direction to the lithium ion battery, the controllerdetermines that both the main relayand the additional relayare in the on state. Further, when the detected current direction is a direction from the lithium ion batteryto the first load circuit, the controllermay determine that both the main relayand the additional relayare in the on state. Further, when the detected current direction is a direction from the lithium ion batteryto each load included in the second load circuit, the controllerdetermines that the main relayis in the off state and the additional relayis in the on state. Further, when the detected current direction is not either direction, the controllerdetermines that at least the additional relayis in the off state. Note that the determination method using the detection result of the current sensoris only an example. For example, when a signal indicating the on state or the off state can be acquired from each of the main relayand the additional relay, the controllermay determine the states of the main relayand the additional relaybased on the signals acquired from the main relayand the additional relay. In the description of the following steps, it is assumed that when the controlleroutputs the opening control signal to the main relayor the additional relay, the controllerexecutes the above-described processing before outputting the opening control signal.

2 FIG.A 2 6 68 6 68 6 6 68 6 6 3 6 6 2 68 6 2 5 1 21 68 Returning to, in step S, the controllerdetermines whether or not the vehicle is in the parked state based on operation information from the ignition switch. When the controlleracquires an on signal indicating that the drive source of the vehicle has been stated from the ignition switch, the controllerdetermines that the vehicle has changed from the parked state to the travel-ready state and that the vehicle is not in the parked state accordingly. On the other hand, when the controlleracquires an off signal indicating that the drive source of the vehicle is stopped from the ignition switch, the controllerdetermines that the vehicle is in the parked state. When the controllermakes a negative determination, the processing proceeds to step S. When the controllermakes an affirmative determination, the controllerwaits in step Sfor a negative determination, that is, for the ignition switchbeing turned on and the vehicle being ready to travel accordingly. While the processing of the controllerwaits in step S, the additional relayis turned off by the process of step S, so that it is possible to prevent the lithium ion batteryfrom being discharged by the dark current of the load. Note that the method for determining whether or not the vehicle is in the parked state is not limited to the determination method based on operation information from the ignition switch, and may be any other determination method known at the time of filing of this application.

3 6 31 3 3 FIG. 3 FIG. 2 FIG.A After proceeding to step S, the processing of the controllerproceeds to step Sin a subroutine illustrated in.is a flowchart illustrating an example of the subroutine of step Sillustrated in.

31 6 5 5 21 3 2 5 5 5 5 4 6 5 6 5 6 5 5 4 33 In step S, the controlleroutputs a connection maintaining command to the additional relay. The additional relayis switched from off to on according to the connection maintaining command, and the lithium ion batteryand the power supply lineon the second load circuitside are electrically connected to each other accordingly. As described in connection with the additional relay, the connection maintaining command is a command that has a compulsory force to maintain the on state. Therefore, for example, even when an opening/closing control signal is input to the additional relayfor some reason, in a case where the connection maintaining command has been input to the additional relaybefore that, the additional relayignores the input opening/closing control signal and forcibly maintains the on state according to the connection maintaining command. In this step, before the failure diagnosis for the main relayis performed, the controllermaintains the on state of the additional relay. Further, until the controlleroutputs a cancellation command to the additional relay, the controlleroutputs the connection maintaining command to the additional relayat predetermined intervals (e.g., every 100 ms). This makes it possible to further reduce the possibility that the additional relayis turned off while the failure diagnosis for the main relayis performed in step S, which will be described later.

32 6 4 4 4 1 2 1 2 4 21 4 2 31 21 2 4 4 1 2 In step S, the controlleroutputs an opening control signal to the main relay. When a stuck-on failure has not occurred in the main relay, the main relayis switched from on to off, and the first load circuitis electrically disconnected from the second load circuitaccordingly. Even when the first load circuitis electrically disconnected from the second load circuitby the main relaybeing turned off, the voltage of the lithium ion batteryis applied to the terminal of the main relayon the second load circuitside by the process of step S. Further, the voltage of the lithium ion batteryis applied to each load included in the second load circuit. On the other hand, when a stuck-on failure has occurred in the main relay, the main relayis not switched from on to off, and the electrically-connected state is maintained between the first load circuitand the second load circuit.

33 6 4 4 4 63 64 1 2 1 2 4 1 2 4 4 61 1 2 4 1 2 4 4 1 2 4 4 4 6 In step S, the controlleroutputs a failure diagnosis start signal to the main relay. In the present embodiment, the main relayuses the input of the failure diagnosis start signal as a trigger to perform the failure diagnosis using the self-diagnosis function. For example, the main relaydetermines, based on the detection results of the first voltage sensorand the second voltage sensor, whether or not a voltage difference between the circuit voltage of the first load circuitand the circuit voltage of the second load circuitis equal to or higher than a predetermined determination voltage. The determination voltage is a voltage threshold value defined for determining a stuck-on failure of a relay. When the voltage difference between the circuit voltage of the first load circuitand the circuit voltage of the second load circuitis equal to or higher than the predetermined determination voltage, the main relaydetermines that a stuck-on failure has not occurred. On the other hand, when the voltage difference between the circuit voltage of the first load circuitand the circuit voltage of the second load circuitis lower than the predetermined determination voltage, the main relaydetermines that a stuck-on failure has occurred. For example, the main relaymay determine, based on the detection result of the current sensor, whether or not a current is flowing in a direction from the first load circuitside to the second load circuitside via the main relay. When a current is flowing from the first load circuitside to the second load circuitside via the main relay, the main relaydetermines that a stuck-on failure has occurred. On the other hand, when a current is not flowing from the first load circuitside to the second load circuitside via the main relay, the main relaydetermines that a stuck-on failure has not occurred. The result of the failure diagnosis performed by the main relayis output to the controller.

34 6 33 4 33 6 4 33 6 4 6 35 6 36 In step S, the controllerdetermines, based on the result of the failure diagnosis in step S, whether or not the main relayis out of order. When the failure diagnosis result in step Sindicates that a stuck-on failure has not occurred, the controllerdetermines that the main relayis not out of order. On the other hand, when the failure diagnosis result in step Sindicates that a stuck-on failure has occurred, the controllerdetermines that the main relayis out of order. When the controllermakes a negative determination, the processing proceeds to step S, and when the controllermakes an affirmative determination, the processing proceeds to step S.

35 6 4 5 6 5 31 5 31 6 5 35 4 3 FIG. 2 FIG.A In step S, the controlleroutputs a closing control signal to the main relayand the additional relay. Further, the controlleroutputs a cancellation command to the additional relaywith respect to the connection maintaining command output in step S. Since the connection maintaining command has been input to the additional relaythrough the process of step S, the controllermay not output the closing control signal to the additional relay. When the process of step Sis completed, the subroutine illustrated inis exited, and the processing proceeds to step Sillustrated in.

34 36 36 6 70 70 70 62 6 71 4 6 72 6 71 72 4 36 4 3 FIG. 2 FIG.A When an affirmative determination is made in step S, the processing proceeds to step S. In step S, the controlleroutputs a command to the advanced driver assistance systemto prohibit the driving mode of the vehicle from being set to the autonomous driving mode. When the advanced driver assistance systemacquires an autonomous driving mode setting prohibition command, the advanced driver assistance systemdisables an on signal from the autonomous driving mode switch, for example. Further, the controllermay output a warning indicator signal to the display deviceto notify the driver that the autonomous driving mode is prohibited from being set because of a failure of the main relay. Further, the controllermay output a warning sound signal to the buzzer. Further, the controllermay output a warning indicator signal to the display deviceand also output a warning sound signal to the buzzer. This is because it is determined that the main relayis out of order and the vehicle is prohibited from traveling in the autonomous driving mode accordingly. When the process of step Sis completed, the subroutine illustrated inis exited, and the processing proceeds to step Sillustrated in.

35 36 4 4 6 4 6 34 4 6 13 6 5 68 4 3 3 FIG. 2 FIG.A 3 FIG. 2 FIG.B When the process of step Sor step Sinis completed, the processing proceeds to step Sin. In step S, the controllerdetermines whether or not the main relayis out of order. For example, the controllerrefers to the determination result in step Sinto determine whether or not the main relayis out of order. When the controllermakes an affirmative determination, the processing proceeds to step Sillustrated in, and when the controllermakes a negative determination, the processing proceeds to step S. In the present embodiment, the vehicle can travel not only when the ignition switchis in the on state but also when the failure diagnosis for the main relayis completed. In other words, the process of step Sis performed in the parked state of the vehicle as it is the failure diagnosis for the vehicle.

5 6 6 62 6 6 2 6 6 2 6 6 6 6 13 2 FIG.B In step S, the controllerdetermines whether the driving mode of the vehicle is the autonomous driving mode or the normal driving mode. For example, when the controlleracquires the on signal from the autonomous driving mode switch, the controllermay determine that the driving mode of the vehicle is the autonomous driving mode. Further, when the controllerdetects the output of a control signal for operating each load included in the second load circuit, the controllermay determine that the driving mode of the vehicle is the autonomous driving mode. Further, when the controlleracquires a signal indicating that each load included in the second load circuitis in operation, the controllermay determine that the driving mode of the vehicle is the autonomous driving mode. When any one of the above-described examples applies, the controllerdetermines that the driving mode of the vehicle is the autonomous driving mode. On the other hand, when none of the above-described examples applies, the controllerdetermines that the driving mode of the vehicle is the normal driving mode. When it is determined that the driving mode of the vehicle is the autonomous driving mode, the processing proceeds to step S, and when it is determined that the driving mode of the vehicle is the normal driving mode, the processing proceeds to step Sillustrated in.

6 62 6 6 66 6 6 67 6 6 6 70 70 62 70 70 62 70 6 70 Note that a method for determining that the driving mode of the vehicle is the normal driving mode has been described using as an example a method for determining that the driving mode of the vehicle is not the autonomous driving mode. However, it may be determined that the driving mode of the vehicle is the normal driving mode in any other way. For example, when the controlleracquires an off signal from the autonomous driving mode switch, the controllermay determine that the driving mode of the vehicle is the normal driving mode. Further, when the controlleracquires a signal of a brake operation by the driver from the brake switch, the controllermay determine that the driving mode of the vehicle is the normal driving mode. Further, when the controlleracquires a signal of a steering operation by the driver from the torque sensor, the controllermay determine that the driving mode of the vehicle is the normal driving mode. When any one of the above-described examples applies, the controllermay determine that the driving mode of the vehicle is the normal driving mode. Further, the controllermay acquire a driving mode signal indicating the driving mode of the vehicle from the advanced driver assistance system, and determine, based on the driving mode signal, whether the driving mode of the vehicle is the autonomous driving mode or the normal driving mode. For example, when the advanced driver assistance systemacquires the on signal from the autonomous driving mode switch, the advanced driver assistance systemdetermines that the driving mode of the vehicle is the autonomous driving mode. Further, when the advanced driver assistance systemacquires an off signal from the autonomous driving mode switch, the advanced driver assistance systemdetermines that the driving mode of the vehicle is the normal driving mode. The controllermay determine whether the driving mode of the vehicle is the autonomous driving mode or the normal driving mode according to the driving mode signal acquired from the advanced driver assistance system.

6 6 4 5 6 5 6 5 6 5 5 6 4 4 4 4 In step S, the controlleroutputs a cancellation command to the main relay, and outputs a connection maintaining command to the additional relay. When it is determined that the driving mode of the vehicle is the autonomous driving mode, in this step, the controllermaintains the on state of the additional relay. Further, until the controlleroutputs a cancellation command to the additional relay, the controlleroutputs the connection maintaining command to the additional relayat predetermined intervals (e.g., every 100 ms). This makes it possible to further reduce the possibility that the additional relayis turned off in the autonomous driving mode. On the other hand, the controlleroutputs the cancellation command to the main relayso that the main relaycan be controlled by an opening/closing control signal. In a case where the main relayis a semiconductor relay having the self-disconnection/connection function as in the present embodiment, the self-disconnection/connection function of the main relayis enabled by the cancellation command.

7 6 100 2 6 64 2 2 2 6 100 8 6 100 9 In step S, the controllerdetermines whether or not a voltage abnormality has occurred in the power supply systembased on the circuit voltage of the second load circuit. The controllerdetermines, based on the detection result of the second voltage sensor, whether or not the circuit voltage on the additional battery side (circuit voltage of the second load circuit) is outside a predetermined voltage range. The predetermined voltage range is a range using a unit of voltage and is also a predetermined range. The upper limit value of the predetermined voltage range is a voltage value defined to prevent overvoltage from being applied to each load included in the second load circuit, and the lower limit value of the predetermined range is a voltage value defined to operate each load included in the second load circuitaccording to the specifications. When the controllermakes a negative determination, that is, when it is determined that a voltage abnormality has not occurred in the power supply system, the processing proceeds to step S. On the other hand, when the controllermakes an affirmative determination, that is, when it is determined that a voltage abnormality has occurred in the power supply system, the processing proceeds to step S.

8 6 4 5 8 9 4 5 3 6 8 8 5 100 5 8 4 5 2 FIG.A In step S, the controlleroutputs a closing control signal to the main relayand the additional relay. Note that in the example of, step Sis illustrated for comparison with step S. However, since the main relayand the additional relayare turned on by the process of step S, the controllermay skip the process of step S. When the process of step Sis completed, the processing returns to step Sto determine the driving mode of the vehicle again. When a voltage abnormality does not occur in the power supply systemin a state where the vehicle can travel in the autonomous driving mode, the processes of steps Sto Sare repeatedly executed, so that both the main relayand the additional relaymaintain the on state.

7 9 9 6 4 5 2 4 2 5 6 2 4 1 2 5 2 21 2 21 1 5 6 5 When an affirmative determination is made in step S, the processing proceeds to step S. In step S, the controlleroutputs an opening control signal to the main relay, and outputs a closing control signal to the additional relay. When the circuit voltage of the second load circuitfalls outside the predetermined voltage range in the autonomous driving mode, the main relayis switched from on to off. On the other hand, even when the circuit voltage of the second load circuitis outside the predetermined voltage range in the autonomous driving mode, the additional relaymaintains the on state through the process of step S, regardless of the circuit voltage of the second load circuit. By switching the main relay, the power supply from the first load circuitside to each load included in the second load circuitis cut off. However, since the additional relaymaintains the on state, each load included in the second load circuitis supplied with electric power from the lithium ion battery. In other words, in the autonomous driving mode, each load included in the second load circuitcan continue to operate with the electric power from the lithium ion batteryeven when the power supply from the first load circuitside is cut off. Note that, since the connection maintaining command has been input to the additional relaythrough the process of step S, the controller may not output the closing control signal to the additional relay.

4 4 4 4 2 4 2 64 4 4 6 4 2 2 Further, in the case where the main relayis a semiconductor relay having the self-disconnection/connection function as in the present embodiment, the switching from on to off of the main relaymay be performed by the self-disconnection/connection function of the main relay. For example, when the main relaydetects that the circuit voltage of the second load circuit(the terminal voltage of the main relayconnected to the second load circuit) is outside the predetermined voltage range based on the detection result from the second voltage sensor, the main relaymay be switched from on to off using the self-disconnection/connection function. It is faster for the main relayto be switched from on to off using the self-disconnection/connection function than for the opening control signal to be transmitted from the controllerto the main relay. Therefore, it is possible to further shorten the time during which the circuit voltage of the second load circuitis outside the predetermined voltage range, and thus to further protect each load included in the second load circuit.

10 6 71 6 72 6 71 72 5 6 2 21 In step S, the controlleroutputs a warning indicator signal to the display deviceto notify the driver that an abnormality has occurred in the autonomous driving mode. Further, the controllermay output a warning sound signal to the buzzer. Further, the controllermay output a warning indicator signal to the display device, and also output a warning sound signal to the buzzer. The process of this step urges the driver to change the driving mode from the autonomous driving mode to the normal driving mode. In other words, this step is a step for requesting the driver to take back the driving control that is being performed by the driver assistance device. Since the additional relaymaintains the on state by the process of step S, each load included in the second load circuitoperates with the electric power from the lithium ion battery, and the autonomous travel of the vehicle in the autonomous driving mode continues.

6 11 6 66 67 6 Since the condition for canceling the autonomous driving mode is operational intervention by the driver, when the driver performs driving operations, such as a brake operation, an accelerator operation, and a steering operation, the controllerdetermines in step Sthat the driving mode of the vehicle has changed from the autonomous driving mode to the normal driving mode. For example, when the controlleracquires a signal of a brake operation by the driver from the brake switchor acquires a signal of a steering operation by the driver from the torque sensor, the controllerdetermines that the autonomous driving mode has been canceled and the driving mode of the vehicle has changed to the normal driving mode.

12 6 4 5 5 6 6 5 6 5 6 12 6 2 2 FIGS.A andB In step S, the controlleroutputs a closing control signal to the main relayand the additional relay. Since the connection maintaining command has been input to the additional relaythrough the process of step S, the controllermay not output the closing control signal to the additional relay. Further, the controllermay output a cancellation command to the additional relaywith respect to the connection maintaining command output in step S. When the process of step Sis completed, the controllerends the processing illustrated in.

5 13 13 6 4 5 4 4 4 4 6 4 6 4 6 4 4 4 4 4 6 5 5 2 FIG.B When it is determined in step Sthat the driving mode of the vehicle is the normal driving mode, the processing proceeds to step Sillustrated in. In step S, the controlleroutputs a connection maintaining command to the main relay, and outputs a cancellation command to the additional relay. As described in connection with the main relay, the connection maintaining command is a command that has a compulsory force to maintain the on state. Therefore, for example, even when an opening/closing control signal is input to the main relayfor some reason, in a case where the connection maintaining command has been input to the main relaybefore that, the main relayignores the input opening/closing control signal and forcibly maintains the on state according to the connection maintaining command. When it is determined that the driving mode of the vehicle is the normal driving mode, in this step, the controllermaintains the on state of the main relay. Further, until the controlleroutputs a cancellation command to the main relay, the controlleroutputs the connection maintaining command to the main relayat predetermined intervals (e.g., every 100 ms). This makes it possible to further reduce the possibility that the main relayis turned off in the normal driving mode. In the case where the main relayis a semiconductor relay having the self-disconnection/connection function as in the present embodiment, the self-disconnection/connection function of the main relayis disabled in this step, so that the main relaycan be prevented from being switched from on to off by the self-disconnection/connection function. On the other hand, the controlleroutputs the cancellation command to the additional relayso that the additional relaycan be controlled by an opening/closing control signal.

14 6 100 2 14 7 7 14 6 100 4 6 100 15 2 FIG.A In step S, the controllerdetermines whether or not a voltage abnormality has occurred in the power supply systembased on the circuit voltage of the second load circuit. Step Scorresponds to step S, and thus, the description of step Swill be referred to for the description of step S. When the controllermakes a negative determination, that is, when it is determined that a voltage abnormality has not occurred in the power supply system, the processing returns to step Sillustrated in. On the other hand, when the controllermakes an affirmative determination, that is, when it is determined that a voltage abnormality has occurred in the power supply system, the processing proceeds to step S.

14 4 4 4 100 4 5 13 14 4 5 68 4 5 13 14 6 4 5 1 5 4 When a negative determination is made in step S, the processing returns to step Sto determine again whether or not the main relayis out of order. Regardless of whether or not the main relayis out of order, when a voltage abnormality does not occur in the power supply systemin a state where the vehicle can travel in the normal driving mode, the processes of step S(step S), step S, and step Sare repeatedly executed, so that both the main relayand the additional relaymaintain the on state. Note that when the ignition switchis turned off while the processes of step S(step S), step S, and step Sare being repeatedly executed, the controllerdetermines that the vehicle has changed from the travel-ready state to the parked state, outputs a closing control signal to the main relay, and outputs an opening control signal to the additional relay, as with the process of step S. The additional relayis switched from on to off while the main relaymaintains the on state.

100 5 1 2 1 5 13 14 4 5 1 21 5 5 5 5 4 3 4 4 4 13 4 5 4 2 1 2 A possible state of the power supply systembrought about in a case where the additional relayis switched from on to off from a state where the first load circuitand the second load circuitare electrically connected to each other and a current is flowing from the first load circuitside to the second load circuit side accordingly will now be described. For example, while the processes of step S, step S, and step Sare repeatedly executed, the main relayand the additional relayboth maintain the on state, and thus, a current from the first load circuitside is input to the lithium ion batteryvia the additional relay. In the case where the additional relayis a mechanical relay as in the present embodiment, when the additional relayis switched from on to off, a back electromotive force is generated in the additional relayin order to maintain the current flowing through a coil of the mechanical relay. The back electromotive force turns to a surge voltage that occurs instantaneously, and is input to the main relayvia the power supply line. In the case where the main relayis a semiconductor relay having the self-disconnection/connection function as in the present embodiment, the main relaymay be switched from on to off by the self-disconnection/connection function in response to detecting the surge voltage. However, the main relaymaintains the on state because the self-disconnection/connection function is disabled through the process of step S. Therefore, even when the surge voltage is input to the main relaydue to the switching of the additional relayfrom on to off, the main relaycan be prevented from being switched from on to off. This makes it possible for each load included in the second load circuitto continue to be supplied with electric power from the first load circuitside, maintaining the circuit voltage of the second load circuit.

2 FIG.B 14 15 15 6 4 5 2 5 2 4 13 2 5 4 5 4 13 4 13 6 4 Returning to, when an affirmative determination is made in step S, the processing proceeds to step S. In step S, the controlleroutputs a closing control signal to the main relay, and outputs an opening control signal to the additional relay. When the circuit voltage of the second load circuitfalls outside the predetermined voltage range in the normal driving mode, the additional relayis switched from on to off. On the other hand, even when the circuit voltage of the second load circuitis outside the predetermined voltage range in the normal driving mode, the main relaymaintains the on state through the process of step S, regardless of the circuit voltage of the second load circuit. As described above, since the additional relayis switched from on to off with the main relaybeing in the on state, a surge voltage may occur due to the switching of the additional relayin this step as well. However, the main relaymaintains the on state through the process of step S. Note that, since the connection maintaining command has been input to the main relaythrough the process of step S, the controllermay not output the closing control signal to the main relay.

16 6 2 14 16 7 14 7 14 16 6 100 12 6 100 6 16 2 FIG.A In step S, the controllerdetermines, based on the circuit voltage of the second load circuit, whether or not the voltage abnormality that occurred in step Scontinues. Step Scorresponds to step Sand step, and thus, the description of step Sand stepwill be referred to for the description of step S. When the controllermakes a negative determination, that is, when it is determined that a voltage abnormality has not occurred in the power supply system, the processing proceeds to step Sillustrated in. On the other hand, when the controllermakes an affirmative determination, that is, when it is determined that the voltage abnormality continues to occur in the power supply system, the controllerwaits in step Sfor an affirmative determination.

68 6 16 6 4 5 1 6 4 13 When the ignition switchis turned off while the controllerwaits in step S, the controllerdetermines that the vehicle has changed from the travel ready state to the parked state, outputs a closing control signal to the main relay, and outputs an opening control signal to the additional relay, as with the process of step S. Further, the controllermay output a cancellation command to the main relaywith respect to the connection maintaining command output in step S.

16 12 12 6 4 5 4 13 6 4 6 4 13 12 6 2 FIG.A 2 2 FIGS.A andB When a negative determination is made in step S, the processing proceeds to step Sillustrated in, and in step S, the controlleroutputs a closing control signal to the main relayand the additional relay. Since the connection maintaining command has been input to the main relaythrough the process of step S, the controllermay not output the closing control signal to the main relay. Further, the controllermay output a cancellation command to the main relaywith respect to the connection maintaining command output in step S. When the process of step Sis completed, the controllerends the processing illustrated in.

16 12 68 6 4 5 1 6 4 13 Note that when the processing proceeds from step Sto step Sand the ignition switchis then turned off, the controllerdetermines that the vehicle has changed from the travel-ready state to the parked state, outputs a closing control signal to the main relay, and outputs an opening control signal to the additional relay, as with the process of step S. Further, the controllermay output a cancellation command to the main relaywith respect to the connection maintaining command output in step S.

100 1 2 4 5 6 1 11 14 12 13 2 11 21 22 23 24 4 3 1 2 1 2 5 2 21 68 4 68 5 6 68 2 6 5 31 4 32 4 4 5 33 2 FIG.A 3 FIG. 3 FIG. 3 FIG. As described above, the power supply systemaccording to the present embodiment is a power supply system installed in a vehicle that has a normal driving mode by a driver and an autonomous driving mode, and includes a first load circuit, a second load circuit, a main relay, an additional relay, and a controller. The first load circuitoperates using electric power from a lead batteryor an alternator, and is connected to a load actuatorand a starter motorthat are necessary to continue the normal driving mode. The second load circuitoperates using electric power from the lead batteryor a lithium ion battery, and is connected to an EPS actuator, an ABS actuator, and an ADAS actuatorthat are necessary to continue the autonomous driving mode. The main relayis provided on a power supply linefor electrically connecting the first load circuitand the second load circuitto electrically connect or disconnect the first load circuitto or from the second load circuit. The additional relayelectrically connects or disconnects each load included in the second load circuitto or from the lithium ion battery. In the present embodiment, when the ignition switchis off, the main relayis in an on state, and when the ignition switchis off, the additional relayis in an off state. When the controllerdetermines that the ignition switchhas been switched from off to on (NO in step Sin), the controllerturns on the additional relay(step Sin), and then turns off the main relay(step Sin). The failure diagnosis for the main relayis performed with the main relaybeing off and the additional relaybeing on (step Sin).

5 2 21 21 21 4 21 2 21 21 21 21 Since the additional relaycan electrically disconnect each load included in the second load circuitfrom the lithium ion battery, it is possible to prevent the lithium ion batteryfrom being discharged by a dark current of the load and prevent the remaining battery level of the lithium ion batteryfrom decreasing while the vehicle is in the parked state. As a result, even when a situation occurs in which the main relayis turned off in a state where the vehicle can travel in the autonomous driving mode, the lithium ion batterycan supply electric power to continue autonomous travel to each load included in the second load circuit. Further, it is possible to prevent the lithium ion batteryfrom continuing to discharge in a state where it is an end-of-discharge voltage or lower, that is, prevent the so-called overdischarge of the lithium ion battery. As a result, the deterioration of the lithium ion batterycan be alleviated, and the battery life of the lithium ion batterycan be extended.

5 21 100 100 5 21 100 100 68 5 21 4 1 2 5 4 4 21 14 4 2 4 1 4 2 1 4 1 100 100 21 4 The time required to complete the failure diagnosis for the main relay will now be described using a power supply system according to a comparative example that does not include the additional relayor the lithium ion battery, unlike the power supply systemaccording to the present embodiment. The power supply system according to the comparative example has the same configuration as the power supply systemexcept that it does not include the additional relayor the lithium ion battery. In the power supply system according to the comparative example, when the ignition switch is switched from off to on with the main relay being on, the failure diagnosis for the main relay is performed with the first load circuit and the second load circuit being electrically connected to each other. After the vehicle is started, it takes time for the circuit voltage of the first load circuit to converge to a predetermined voltage due to, for example, alternator voltage fluctuations. Therefore, the failure diagnosis for the main relay cannot be performed until the circuit voltage of the first load circuit converges to the predetermined voltage, and it takes time to start the failure diagnosis for the main relay. In other words, the power supply system according to the comparative example has a problem in that it takes time to complete the failure diagnosis for the main relay after the vehicle is started. However, in the power supply systemand the method for controlling the power supply systemof the present embodiment, when the ignition switchis switched from off to on, the additional relayis turned on, and accordingly, the voltage of the lithium ion batteryis applied to the terminal of the main relay. Then, in a state where the first load circuitand the second load circuitare electrically disconnected from each other by the additional relaybeing turned on and then the main relaybeing turned off, the failure diagnosis for the main relayis performed. After the vehicle is started, the voltage of the lithium ion batteryfluctuates less than the output voltage of the alternator. Accordingly, the voltage applied to the main relayon the second load circuitside converges faster than the voltage applied to the main relayon the first load circuitside. Therefore, the failure diagnosis for the main relaycan be performed on the basis of the circuit voltage of the second load circuitwithout waiting for the circuit voltage of the first load circuitbecoming stable. As in the comparative example, the failure diagnosis for the main relaycan be started earlier than when the failure diagnosis for the main relay is performed on the basis of the circuit voltage of the first load circuit. In other words, according to the power supply systemand the method for controlling the power supply systemof the present embodiment, it is possible to prevent the remaining battery level of the lithium ion batteryfrom decreasing due to dark current discharge, and to shorten the time to complete the failure diagnosis for the main relay.

6 4 5 5 4 4 5 4 5 2 2 4 5 6 Further, in the present embodiment, the controlleracquires information on the state of the main relayand the state of the additional relay, and when the additional relayis in the off state, does not output an opening control signal to the main relay, and when the main relayis in the off state, does not output an opening control signal to the additional relay. This makes it possible to prevent both the main relayand the additional relayfrom being turned off and prevent the power supply to each load included in the second load circuitfrom being interrupted. In addition, it is possible to prevent the power supply to the second load circuitside from being cut off by simply monitoring the state of the main relayand the state of the additional relaywithout requiring complicated processing, making it possible to reduce a computation load on the controllerand improve the processing speed.

6 5 4 21 2 4 4 1 2 21 2 2 Further, in the present embodiment, the controllermaintains the on state of the additional relaywhile the failure diagnosis for the main relayis performed. Accordingly, an electrically-connected state is maintained between the lithium ion batteryand each load included in the second load circuitwhile the failure diagnosis for the main relayis performed. As a result, even when the failure diagnosis for the main relayis performed with the first load circuitand the second load circuitbeing electrically disconnected from each other, it is possible to continue to supply electric power from the lithium ion batteryto each load included in the second load circuit, maintaining the circuit voltage of the second load circuit.

6 4 34 6 4 3 FIG. Further, in the present embodiment, when the controllerdetermines that the main relayis out of order (YES in step Sof), the controlleroutputs a command to prohibit the driving mode of the vehicle from being set to the autonomous driving mode. Accordingly, it is possible to prohibit the vehicle from traveling in the autonomous driving mode in a state where the main relayis out of order.

Note that the embodiment described above is described to facilitate understanding of the present invention, and is not described to limit the present invention. Therefore, the elements disclosed in the above embodiment are meant to include all design changes and equivalents that fall within the technical scope of the present invention.

4 6 5 6 4 6 5 21 21 21 2 FIG.A In the embodiment described above, a case has been described in which when the failure diagnosis for the main relayis completed and it is determined that the driving mode of the vehicle is the normal driving mode (determined to be the normal driving mode in step Sof), the on state of the additional relayis maintained. However, when the controllerdetermines that the driving mode of the vehicle is the normal driving mode after the failure diagnosis for the main relayis completed, the controllermay switch the additional relayfrom on to off. This makes it possible, for example, to prevent the lithium ion batteryfrom being discharged to the loads connected to the lithium ion batteryin the parked state of the vehicle and to prevent the remaining battery level of the lithium ion batteryfrom decreasing.

4 68 4 68 6 68 68 6 4 33 6 4 4 4 4 68 68 6 68 6 68 6 4 68 4 4 3 FIG. Further, in the embodiment described above, a case has been described in which the failure diagnosis for the main relayis performed after the ignition switchis switched from off to on. However, the failure diagnosis for the main relaymay be performed after the ignition switchis switched from on to off. For example, the controllerdetermines whether or not the ignition switchhas been switched from on to off, and when it is determined that the ignition switchhas been switched from on to off, the controllermay output a failure diagnosis start signal to the main relay. In this case, unlike step Sin, the controllermay output the failure diagnosis start signal to the main relaywith the main relaybeing turned on. This is because it may take a long time to complete the failure diagnosis for the main relayafter the vehicle changes to the parked state. Further, in a case where the failure diagnosis for the main relayhas been performed after the ignition switchwas switched from on to off, when the ignition switchis then switched from off to on, the controllerdetermines whether or not the ignition switchhas been switched from off to on within a predetermined interval. Then, when the controllerdetermines that the ignition switchhas been switched from off to on within the predetermined interval, the controllerdoes not output a failure diagnosis start signal to the main relayeven when the ignition switchhas been switched from off to on. The predetermined interval is a period of time defined based on the specifications of the main relay. It is possible to prevent the failure diagnosis for the main relayfrom being performed within a short period of time and to shorten the time from when the vehicle is started to when the vehicle starts traveling.

6 5 1 32 6 5 1 6 14 5 1 21 6 5 1 21 5 1 21 5 5 5 6 14 5 1 3 FIG. Further, in the embodiment described above, a case has been described in which the controllerswitches the additional relayfrom off to on without controlling the circuit voltage of the first load circuitin step Sof. However, the controllermay switch the additional relayfrom off to on after controlling the circuit voltage of the first load circuit. For example, the controllermay control the alternatorbefore turning on the additional relay, thereby setting the circuit voltage of the first load circuitto the voltage of the lithium ion battery. Then, the controllermay switch the additional relayfrom off to on after the circuit voltage of the first load circuitcorresponds to the voltage of the lithium ion battery. This makes it possible to prevent an inrush current from flowing into the additional relaydue to a voltage difference between the circuit voltage of the first load circuitand the voltage of the lithium ion batterywhen the additional relayis switched from off to on. As a result, a failure of the additional relaycan be suppressed, and the rate at which the contacts of the additional relaywear out can also be reduced. Note that the controllercontrols the alternatorafter turning on the additional relayin order to operate each load included in the first load circuitaccording to the specifications, thereby setting the circuit voltage of the first load circuit to a voltage for the vehicle to travel.

4 4 4 4 6 4 4 4 61 1 2 4 1 2 4 4 1 2 4 4 6 4 6 4 Further, in the embodiment described above, a case has been described in which, as a failure diagnosis for the main relay, it is diagnosed whether or not a stuck-on condition has occurred in the main relay. However, the failure diagnosis for the main relaymay include a stuck-on failure diagnosis and a diagnosis of whether or not a stuck-off condition in which the main relayis stuck in the off state has occurred (also referred to as a stuck-off failure diagnosis or an open failure diagnosis). For example, after the stuck-on failure diagnosis is completed, the controlleroutputs a closing control signal to the main relay. The main relaymay perform the stuck-off failure diagnosis using the self-diagnosis function. For example, the main relaydetermines, based on the detection result of the current sensor, whether or not a current is flowing in the direction from the first load circuitside to the second load circuitside via the main relay. When a current is flowing from the first load circuitside to the second load circuitside via the main relay, the main relaydetermines that a stuck-off failure has not occurred. On the other hand, when a current is not flowing from the first load circuitside to the second load circuitside via the main relay, the main relaydetermines that a stuck-off failure has occurred. When a diagnosis result is obtained indicating that at least one of an on-stuck failure and an off-stuck failure has occurred, the controllerdetermines that the main relayis out of order. On the other hand, when a diagnosis result is obtained indicating that either failure has not occurred, the controllerdetermines that the main relayis not out of order.

11 21 14 1 1 22 23 24 2 5 21 2 2 5 21 4 4 4 4 6 6 4 33 5 5 3 FIG. Further, in the embodiment described above, a case has been illustrated in which the lead batteryis used as the main battery. However, as the main battery, a secondary battery, such as a lithium ion battery and a nickel metal hydride battery, may be used. Further, in the embodiment described above, a case has been illustrated in which the lithium ion batteryis used as the additional battery. However, as the additional battery, a plurality of batteries may be used, a set of a capacitor and a DC/DC converter may be used, or a nickel metal hydride battery may be used. Further, in the embodiment described above, a case has been illustrated in which the alternatoris used as the generator of the first load circuit. However, as the generator of the first load circuit, a generator, a motor generator, or the like may be used. Further, in the embodiment described above, a case has been illustrated in which the EPS actuator, the ABS actuator, and the ADAS actuatorare used as the loads included in the second load circuit. However, the loads necessary to continue the autonomous driving mode may be replaced depending on the specifications of the vehicle and the specifications of the driver assistance device. Further, in the embodiment described above, a case has been illustrated in which the additional relayand the lithium ion batteryare not included in the second load circuit. However, the second load circuitmay include the additional relayand the lithium ion battery. Further, in the embodiment described above, a case has been illustrated in which a semiconductor relay having the self-disconnection/connection function and the self-diagnosis function is used as the main relay. However, as the main relay, a semiconductor relay not having the self-disconnection/connection function, a semiconductor relay not having the self-diagnosis function, a semiconductor relay not having the self-disconnection/connection function or the self-diagnosis function, or a mechanical relay may be used. Note that in a case where a semiconductor relay not having the self-diagnosis function is used as the main relay, the failure diagnosis for the main relayis performed by the controller. For example, the controllerperforms the failure diagnosis for the main relayin step Sof. For a method for the failure diagnosis, the method described in the above-described embodiment is used. Further, in the embodiment described above, a case has been illustrated in which a mechanical relay is used as the additional relay. However, as the additional relay, a semiconductor relay may be used.

2 3 Further, in the embodiment described above, a case has been described by way of example in which the power supply system and the method for controlling the power supply system according to the present invention are applied to a vehicle having a hands-off mode of driving assist level. However, the power supply system and the method for controlling the power supply system according to the present invention can also be applied to a vehicle having driving assist level.

68 Further, in the embodiment described above, a case has been described by way of example in which the power supply system and the method for controlling the power supply system according to the present invention are applied to a vehicle with an engine serving as a drive source (engine vehicle). However, the power supply system and the method for controlling the power supply system according to the present invention can be applied to a vehicle with a battery serving as a drive source (electric vehicle), a vehicle with an engine and a battery serving as drive sources (hybrid vehicle), and a vehicle with a fuel cell serving as a drive source (fuel cell vehicle). In summary, they can be applied to a vehicle in which a power supply system is installed, and the power supply system includes: a first load circuit configured to operate using electric power from a main battery, the first load circuit being connected to a first load necessary to continue a normal driving mode; a second load circuit configured to operate using electric power from an additional battery, the second load circuit being connected to a second load necessary to continue an autonomous driving mode; a first relay provided on a power supply line for electrically connecting the first load and the second load, the first relay being configured to electrically connect or disconnect the first load circuit to or from the second load circuit; a second relay configured to electrically connect or disconnect the second load to or from the additional battery; and a controller configured to determine a state of the ignition switch.

11 12 11 13 5 2 FIG.A 2 FIG.B Further, in the embodiment described above, a control procedure has been described by way of example in which the driving mode of the vehicle is changed from the autonomous driving mode to the normal driving mode in step Sofand then the processing proceeds to step S. However, after the process of step S, the processing may proceed to step Sillustrated in, as with a case where it is determined in step Sthat the driving mode of the vehicle is the normal driving mode.

2 7 14 16 1 2 4 6 1 2 14 6 5 5 5 5 6 5 61 5 6 5 5 5 6 5 5 5 5 2 FIG.A 2 FIG.B 2 FIG.B 2 FIG.A Further, in the embodiment described above, a case has been described in which it is determined whether or not the circuit voltage of the second load circuitis outside the predetermined voltage range in step Sofand step Sand step Sof. However, since in any of the steps, the first load circuitand the second load circuitare electrically connected to each other by the main relay, the controllermay determine in each step determine whether or not the circuit voltage of the first load circuitis outside the predetermined voltage range. Further, in the embodiment described above, a case has been described in which when the circuit voltage of the second load circuitis outside the predetermined voltage range in step Sof, the controllerswitches the additional relayfrom on to off. However, the condition for switching the additional relayfrom on to off with the driving mode of the vehicle being the normal driving mode may be that the current flowing through the additional relayis equal to or higher than a predetermined current threshold value. For example, when it is determined that the driving mode of the vehicle is the normal driving mode (determined to be the normal driving mode in step Sof), the controllercompares the current flowing through the additional relaywith the predetermined current threshold value based on the detection result from the current sensor. The direction of the current flowing through the additional relayis not particularly limited, and the controllercompares the absolute value of the current flowing through the additional relaywith the predetermined current threshold value. The unit of the predetermined current threshold value is electric current, and the predetermined current threshold value is a current threshold value defined based on the contact life of the additional relay. When the absolute value of the current flowing through the additional relayis equal to or higher than the predetermined current threshold value, the controlleroutputs an opening control signal to the additional relay. Thus, when an excessive current flows through the additional relayin the normal driving mode, the rate at which the contacts of the additional relaywear out can be reduced by switching the additional relayfrom on to off.

6 4 7 2 2 2 7 6 4 6 5 14 2 2 2 14 6 5 2 FIG.A 2 FIG.B Further, in the embodiment described above, as the condition for the controllerto turn off the main relayin step Sof, a condition has been described by way of example that the circuit voltage of the second load circuitis outside the predetermined voltage range. However, when the circuit voltage of the second load circuitis lower than the lower limit value of the predetermined voltage range or the circuit voltage of the second load circuitis higher than the upper limit value of the predetermined voltage range in step S, the controllermay turn off the main relay. Similarly, in the embodiment described above, as the condition for the controllerto turn off the additional relayin step Sof, a condition has been described by way of example that the circuit voltage of the second load circuitis outside the predetermined voltage range. However, when the circuit voltage of the second load circuitis lower than the lower limit value of the predetermined voltage range or the circuit voltage of the second load circuitis higher than the upper limit value of the predetermined voltage range in step S, the controllermay turn off the additional relay.

1 First load circuit 11 Lead battery 12 Load actuator 13 Starter motor 14 Alternator 2 Second load circuit 21 Lithium ion battery 22 EPS actuator 23 ABS actuator 24 ADAS actuator 3 Power supply line 4 Main relay 5 Additional relay 6 Controller 61 Current sensor 62 Autonomous driving mode switch 63 First voltage sensor 64 Second voltage sensor 65 Battery voltage sensor 66 Brake switch 67 Torque sensor 68 Ignition switch 69 Vehicle speed sensor 70 Advanced driver assistance system 71 Display device 72 Buzzer 100 Power supply system